“accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine’s aws and azure images) take any password longer than 256 characters.”
Send 257 characters of anything and the locked accounts let you in. That is OpenSSH on Alpine and every other musl system that skips PAM. The cause is a musl change from 2012. Fourteen years and nobody noticed. OpenSSH 10.6p2 fixes it. Update, or turn password logins off today.